FBI Warns of Kali365: Device Code Phishing Now Bypasses MFA on Government Microsoft 365 Tenants

Public Sector

Published on

May 25, 2026

Table of Contents

Threat Assessment Level: ELEVATED (trending toward HIGH) The convergence of FBI-validated credential theft tooling targeting Microsoft 365 device code authentication, an active cross-ecosystem supply chain campaign poisoning developer environments, and a foreign state breach of a government registry exfiltrating 600,000+ records demands immediate defensive action from state government IT leadership. <h2> Introduction </h2> State government CIOs and CISOs face a compounding threat picture this week. The FBI issued a Public Service Announcement on 21 May 2026 warning of Kali365 , a Phishing-as-a-Service platform that captures OAuth tokens from Microsoft 365 environments — bypassing multi-factor authentication entirely. This isn't theoretical: the platform is actively distributed via Telegram, offers AI-generated lures, and exploits the same device code authentication flow that state government M365 GCC tenants rely on for shared kiosks and conference room devices. Simultaneously, a 34-package supply chain campaign called TrapDoor is stealing developer credentials across npm, PyPI, and Crates.io — and pioneering a novel technique that poisons AI coding assistants into exfiltrating secrets. And in Lithuania, a foreign state actor compromised inter-agency credentials to exfiltrate 600,000 records from a government property registry — an operation with direct parallels to how U.S. state agencies share identity infrastructure across departments. This report provides actionable intelligence for state agency leadership to defend against these converging threats. <h2> What Changed This Week </h2> <table> <thead> <tr> <th> Development </th> <th> Why It Matters for State Government </th> </tr> </thead> <tbody> <tr> <td> FBI PSA on Kali365 PhaaS (21 May) </td> <td> Directly threatens state M365 GCC tenants; bypasses MFA via device code flow </td> </tr> <tr> <td> TrapDoor supply chain attack (22 May) </td> <td> 34+ malicious packages across 3 ecosystems; novel AI assistant poisoning technique </td> </tr> <tr> <td> Lithuania government registry breach (confirmed May 2026) </td> <td> 600K records exfiltrated via compromised inter-agency accounts; Russian attribution suspected </td> </tr> <tr> <td> CISA adds 10 KEVs in 72 hours (20–22 May) </td> <td> Unprecedented patch velocity requirement; includes ICS advisories for building automation </td> </tr> <tr> <td> ABB/Hitachi/Siemens ICS advisories (21 May) </td> <td> Directly relevant to state building automation and energy grid oversight </td> </tr> <tr> <td> WhatsApp phishing of government officials (multi-country, confirmed) </td> <td> Russian-linked campaign intercepting verification codes from parliamentarians and staff </td> </tr> </tbody> </table> <h2> Threat Timeline </h2> <table> <thead> <tr> <th> Date </th> <th> Event </th> <th> Actor/Campaign </th> <th> Impact </th> </tr> </thead> <tbody> <tr> <td> 20 May 2026 </td> <td> CISA adds 7 vulnerabilities to KEV catalog </td> <td> Multiple </td> <td> Accelerated patching required </td> </tr> <tr> <td> 21 May 2026 </td> <td> CISA adds 2 KEVs; publishes 4 ABB ICS advisories + Hitachi GMS600 + Siemens RUGGEDCOM </td> <td> Multiple </td> <td> State building automation/SCADA exposure </td> </tr> <tr> <td> 21 May 2026 </td> <td> FBI issues PSA on Kali365 PhaaS platform </td> <td> Criminal (Telegram-distributed) </td> <td> M365 OAuth token theft bypassing MFA </td> </tr> <tr> <td> 22 May 2026 </td> <td> CISA adds 1 KEV </td> <td> Multiple </td> <td> Continued patch pressure </td> </tr> <tr> <td> 22 May 2026 </td> <td> TrapDoor campaign begins publishing malicious packages </td> <td> Unknown (criminal/espionage) </td> <td> Developer credential theft; AI assistant poisoning </td> </tr> <tr> <td> 25 May 2026 </td> <td> BITWISE SPIDER (LockBit), PUNK SPIDER (Akira), REVENANT SPIDER (Qilin) show updated activity </td> <td> Ransomware operators </td> <td> No new gov-specific campaigns — but active development confirmed </td> </tr> <tr> <td> Ongoing </td> <td> Lithuania Centre of Registers breach investigation </td> <td> Russian state (suspected) </td> <td> 600K records including intelligence/military personnel data </td> </tr> <tr> <td> Ongoing </td> <td> Volt Typhoon / Salt Typhoon </td> <td> China-nexus </td> <td> Silence noted — pre-positioning in U.S. critical infrastructure continues without new public reporting </td> </tr> </tbody> </table> <h2> Key Threat Analysis </h2> <h3> 1. Kali365: The MFA Bypass That Targets Your Exact Infrastructure </h3> What it is: Kali365 is a Phishing-as-a-Service platform that abuses Microsoft's legitimate device code authentication flow. When a user is tricked into entering a code at microsoft.com/devicelogin, the attacker captures a full OAuth token granting access to Outlook, Teams, OneDrive, and SharePoint — without ever needing the user's password or MFA token. Why state government is uniquely exposed: State M365 GCC tenants typically have device code flow enabled for conference room displays, shared kiosks, and legacy integrations. The platform provides AI-generated lures mimicking IT helpdesk communications — exactly the kind of messages state employees are conditioned to trust. Validation: This finding is corroborated by the FBI PSA, Proofpoint research confirming "new device code phishing tools every week," and prior reporting on Tycoon2FA using the same technique. Confidence: MODERATE-HIGH . Relevant ATT&CK Techniques: T1566.002 (Spearphishing Link), T1528 (Steal Application Access Token), T1078.004 (Cloud Accounts), T1114.002 (Remote Email Collection) <h3> 2. TrapDoor: Supply Chain Attack Poisons AI Coding Assistants </h3> What it is: Beginning 22 May 2026, attackers published 34+ malicious packages across npm, PyPI, and Crates.io (384+ versions total). The packages steal SSH keys, AWS credentials, GitHub tokens, and environment variables. The novel element: TrapDoor plants .cursorrules and CLAUDE.md files that inject hidden instructions into AI coding assistants (Cursor, Claude Code, GitHub Copilot), tricking them into running "security scans" that exfiltrate secrets. Why state government is exposed: State DevOps teams building citizen-facing portals, tax systems, and internal tools increasingly use AI coding assistants and open-source dependencies. A single compromised package in a CI/CD pipeline could expose cloud credentials, database connection strings, and API keys. Known malicious packages include: wallet-security-checker, eth-security-auditor, crypto-credential-scanner, prompt-engineering-toolkit, llm-context-compressor, sui-sdk-build-utils (34 total across 3 ecosystems) Attacker infrastructure: ddjidd564.github[.]io (GitHub Pages payload host) Relevant ATT&CK Techniques: T1195.002 (Supply Chain Compromise), T1552.001 (Credentials in Files), T1555 (Credentials from Password Stores), T1543.002 (Systemd Service persistence) <h3> 3. Lithuania Government Registry Breach: A Warning for State Agencies </h3> What it is: Lithuania's Centre of Registers suffered unauthorized access resulting in exfiltration of 600,000+ records including personal identification numbers. The attacker gained access through compromised Migration Department accounts — exploiting inter-agency credential trust to reach a different agency's data. Why this is a direct parallel: U.S. state governments maintain analogous registries (property, tax, motor vehicles, vital records) and routinely share identity infrastructure across agencies via federated authentication. A compromise of one agency's service accounts can cascade to every connected system. Attribution: Lithuanian prosecutors confirmed foreign state origin. Opposition leadership attributes the operation to Russian intelligence. Confidence in Russian attribution: LOW (single source, investigation ongoing). Relevant ATT&CK Techniques: T1078 (Valid Accounts), T1078.002 (Domain Accounts), T1530 (Data from Cloud Storage), T1537 (Transfer Data to Cloud Account) <h3> 4. ICS/SCADA Advisory Surge: Building Automation and Energy Grid Exposure </h3> CISA published advisories for ABB B&R Automation Studio , ABB B&R PCs , ABB B&R Automation Runtime , ABB Terra AC Wallbox , ABB CoreSense , Hitachi Energy GMS600 (CVE-2022-4304), and Siemens RUGGEDCOM APE1808 (PAN-OS buffer overflow). These systems are deployed in state government building automation, EV charging infrastructure, and energy grid monitoring. Combined with the 10 KEVs added in 72 hours (20–22 May), the patch velocity requirement is unprecedented. State agencies with OT/ICS environments must prioritize these advisories. <h3> 5. Persistent Nation-State Threats: Unchanged but Unresolved </h3> <table> <thead> <tr> <th> Actor </th> <th> Origin </th> <th> Current Status </th> <th> State Gov Relevance </th> </tr> </thead> <tbody> <tr> <td> APT28 (GRU Unit 26165) </td> <td> Russia </td> <td> Destructive backdoor deployed 19–21 May; WhatsApp phishing of officials confirmed </td> <td> HIGH — targets government officials, messaging platforms </td> </tr> <tr> <td> APT29 / Midnight Blizzard </td> <td> Russia (SVR) </td> <td> Active; Lithuania breach potentially linked </td> <td> HIGH — government espionage </td> </tr> <tr> <td> Volt Typhoon </td> <td> China </td> <td> Silent this cycle — not assumed inactive </td> <td> CRITICAL — pre-positioned in U.S. critical infrastructure </td> </tr> <tr> <td> Salt Typhoon </td> <td> China </td> <td> Silent this cycle </td> <td> HIGH — telecom/infrastructure access </td> </tr> <tr> <td> APT43 </td> <td> North Korea </td> <td> Rapport-building campaigns active </td> <td> MODERATE — revenue generation, social engineering </td> </tr> <tr> <td> BITWISE SPIDER (LockBit) </td> <td> Criminal </td> <td> Updated 25 May, no new gov campaigns </td> <td> HIGH — historical state/local gov targeting </td> </tr> <tr> <td> PUNK SPIDER (Akira) </td> <td> Criminal </td> <td> Updated 25 May </td> <td> HIGH — active ransomware threat </td> </tr> <tr> <td> REVENANT SPIDER (Qilin) </td> <td> Criminal </td> <td> Updated 25 May </td> <td> MODERATE-HIGH — expanding target set </td> </tr> </tbody> </table> <h2> Predictive Analysis: Next 7 Days </h2> <table> <thead> <tr> <th> Scenario </th> <th> Probability </th> <th> Basis </th> </tr> </thead> <tbody> <tr> <td> Additional PhaaS platforms exploiting device code flow emerge </td> <td> 70% </td> <td> Proofpoint confirms "new tools every week"; low barrier to entry </td> </tr> <tr> <td> TrapDoor campaign expands package list; copycat campaigns target government-specific package names </td> <td> 60% </td> <td> Pattern of rapid iteration in supply chain attacks; government DevOps is undertargeted </td> </tr> <tr> <td> CISA adds Ivanti EPMM CVE-2026-1281/1340 to KEV catalog </td> <td> 40% </td> <td> Active exploitation campaign confirmed; Ivanti widely deployed in state government </td> </tr> <tr> <td> Ransomware group claims state/local government victim </td> <td> 30% </td> <td> Statistical baseline given current actor tempo; all three major groups showing activity </td> </tr> <tr> <td> Volt Typhoon activity surfaces in new public reporting </td> <td> 25% </td> <td> Silence is operational security, not cessation; congressional pressure for disclosure continues </td> </tr> </tbody> </table> <h2> SOC Operational Guidance </h2> <h3> Detection Priorities </h3> <table> <thead> <tr> <th> Priority </th> <th> What to Monitor </th> <th> ATT&CK ID </th> <th> Detection Logic </th> </tr> </thead> <tbody> <tr> <td> P1 </td> <td> Device code authentication events in Azure AD </td> <td> T1528 </td> <td> Alert on DeviceCodeUserLogin events in Azure AD sign-in logs, especially from unexpected geolocations, user agents, or for users who have never used device code flow </td> </tr> <tr> <td> P1 </td> <td> OAuth token grants with unusual scope </td> <td> T1078.004 </td> <td> Monitor for tokens granting Mail.Read, Files.Read.All, or Sites.Read.All via device code flow </td> </tr> <tr> <td> P2 </td> <td> npm/PyPI package installations in CI/CD </td> <td> T1195.002 </td> <td> Scan for any of the 34 TrapDoor package names in package.json, requirements.txt, Cargo.toml </td> </tr> <tr> <td> P2 </td> <td> Presence of .cursorrules or CLAUDE.md in repos </td> <td> T1195.002 </td> <td> File integrity monitoring on development repositories for AI assistant config files </td> </tr> <tr> <td> P3 </td> <td> Inter-agency service account anomalies </td> <td> T1078.002 </td> <td> Baseline normal access patterns for shared service accounts; alert on access to registries/databases outside normal hours or from new source IPs </td> </tr> <tr> <td> P3 </td> <td> ICS/OT network traffic anomalies </td> <td> T0831 </td> <td> Monitor ABB/Hitachi/Siemens device communications for unexpected outbound connections or firmware update attempts </td> </tr> </tbody> </table> <h3> Hunting Hypotheses </h3> <ul> <li> Hypothesis: An attacker has already obtained OAuth tokens via device code phishing and is silently reading executive email. </li> </ul> <ul> <li> Hunt: Query Azure AD sign-in logs for authenticationProtocol == deviceCode in the last 30 days. Cross-reference with impossible travel or unfamiliar device registrations. Check for mail forwarding rules ( T1114.003 ) created after device code authentications. </li> </ul> <ul> <li> Hypothesis: A malicious npm/PyPI package has been installed in a state agency CI/CD pipeline and is exfiltrating environment variables. </li> </ul> <ul> <li> Hunt: Audit all package-lock.json and requirements.txt files across repositories for packages matching TrapDoor names. Check CI/CD runner logs for outbound connections to ddjidd564.github[.]io. Review environment variable access patterns in build logs. </li> </ul> <ul> <li> Hypothesis: A compromised inter-agency service account is being used to access databases beyond its normal scope. </li> </ul> <ul> <li> Hunt: Pull authentication logs for all federated/shared service accounts. Build a baseline of normal database access patterns. Flag any account accessing property, tax, or vital records databases that historically only accessed its home agency's systems. </li> </ul> <h3> Blocking Actions </h3> <ul> <li> Block ddjidd564.github[.]io at web proxy and DNS resolver </li> <li> Consider blocking microsoft.com/devicelogin at the proxy level for all users except those with documented business need (conference room devices, kiosks) — implement via Conditional Access instead if possible </li> <li> Add TrapDoor package names to internal package registry deny-lists </li> </ul> <h2> Sector-Specific Defensive Priorities </h2> <h3> Financial Services (State Treasury, Revenue, Tax Systems) </h3> <ul> <li> Primary threat: Kali365 OAuth token theft targeting finance staff with access to payment systems and tax databases </li> <li> Action: Implement Conditional Access policies requiring compliant devices AND named locations for any access to financial applications. Review all OAuth app consents in the tenant for finance-related apps. </li> <li> Lithuania parallel: Tax registries containing SSNs and financial data are high-value targets for state-sponsored exfiltration. Audit inter-agency access to tax databases. </li> </ul> <h3> Energy (State Energy Office, Utility Oversight, Building Automation) </h3> <ul> <li> Primary threat: ABB/Hitachi/Siemens ICS vulnerabilities (ICSA-26-141-01 through -05); Volt Typhoon pre-positioning </li> <li> Action: Inventory all ABB B&R, Hitachi Energy GMS600, and Siemens RUGGEDCOM devices in state facilities. Apply patches per CISA advisories. Verify network segmentation between IT and OT environments. Ensure no direct internet connectivity for ICS devices. </li> <li> CVE-2022-4304 (OpenSSL timing side-channel in Hitachi GMS600) requires firmware update. </li> </ul> <h3> Healthcare (State Health Department, Medicaid Systems) </h3> <ul> <li> Primary threat: Ransomware (BITWISE SPIDER/LockBit, PUNK SPIDER/Akira) targeting health data; credential theft via Kali365 for access to Medicaid PII </li> <li> Action: Verify offline backups of Medicaid enrollment databases. Ensure health system portals are not using any of the 34 TrapDoor packages. Conduct tabletop exercise for ransomware scenario affecting benefits processing. </li> </ul> <h3> Government (All Executive Branch Agencies) </h3> <ul> <li> Primary threat: Russian state-sponsored credential compromise and registry exfiltration (Lithuania model); WhatsApp/Signal phishing of officials </li> <li> Action: Brief all senior officials on messaging platform verification code phishing — never share codes. Audit all inter-agency service accounts and apply least-privilege. Implement break-glass alerting for any service account accessing databases outside its designated scope. </li> <li> APT28 WhatsApp phishing ( T1111 , T1566.002 ) is confirmed targeting government officials across multiple countries. </li> </ul> <h3> Aviation/Logistics (State DOT, Port Authorities, Transit Systems) </h3> <ul> <li> Primary threat: Volt Typhoon pre-positioning in transportation infrastructure; ICS vulnerabilities in traffic management and transit SCADA </li> <li> Action: Conduct network segmentation audit for all OT systems managing traffic signals, transit operations, and port logistics. Verify that Siemens RUGGEDCOM devices (if deployed in transportation networks) have current PAN-OS firmware. Implement enhanced monitoring for lateral movement from IT to OT networks. </li> </ul> <h2> Prioritized Defense Recommendations </h2> <h3> IMMEDIATE (Within 24 Hours) </h3> <table> <thead> <tr> <th> Priority </th> <th> Owner </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 🔴 </td> <td> CISO/IAM Team </td> <td> Block device code authentication flow in Azure AD Conditional Access policies. Create narrow exceptions only for documented legitimate use cases (conference room devices, shared kiosks). Kali365 is actively exploiting this flow. </td> </tr> <tr> <td> 🔴 </td> <td> SOC </td> <td> Create detection rule for DeviceCodeUserLogin events in Azure AD sign-in logs. Alert on any device code authentication from unexpected geolocations or user agents. </td> </tr> <tr> <td> 🔴 </td> <td> DevOps </td> <td> Audit all repositories for .cursorrules, CLAUDE.md, and similar AI assistant configuration files. Remove unauthorized entries immediately. </td> </tr> <tr> <td> 🔴 </td> <td> Network Security </td> <td> Block ddjidd564.github[.]io at DNS and web proxy. </td> </tr> </tbody> </table> <h3> 7-DAY </h3> <table> <thead> <tr> <th> Priority </th> <th> Owner </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 🟠 </td> <td> DevOps </td> <td> Scan all CI/CD pipelines for TrapDoor package names. Pin all npm/PyPI dependencies to exact versions with hash verification. Implement package allow-listing for production builds. </td> </tr> <tr> <td> 🟠 </td> <td> OT/Facilities </td> <td> Apply patches for ABB B&R Automation Studio, B&R PCs, B&R Automation Runtime, Hitachi Energy GMS600, and verify Siemens RUGGEDCOM APE1808 firmware per CISA ICS advisories ICSA-26-141-01 through -05. </td> </tr> <tr> <td> 🟠 </td> <td> Security Awareness </td> <td> Issue all-staff advisory on WhatsApp/Signal verification code phishing. Key message: never share verification codes received via SMS, even if the request appears to come from IT or a colleague. </td> </tr> <tr> <td> 🟠 </td> <td> IAM Team </td> <td> Audit all OAuth application consents in M365 GCC tenant. Revoke any suspicious or overprivileged app registrations. Implement admin consent workflow for new app registrations. </td> </tr> </tbody> </table> <h3> 30-DAY </h3> <table> <thead> <tr> <th> Priority </th> <th> Owner </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 🟡 </td> <td> CISO </td> <td> Evaluate complete elimination of device code flow in M365 GCC tenant. Document all legitimate dependencies and architect alternatives (QR code sign-in, FIDO2 for shared devices). </td> </tr> <tr> <td> 🟡 </td> <td> IR Team </td> <td> Conduct tabletop exercise simulating a property/tax registry breach via compromised inter-agency service accounts (Lithuania scenario). Test detection, containment, notification, and recovery procedures. </td> </tr> <tr> <td> 🟡 </td> <td> Enterprise Architecture </td> <td> Review all inter-agency service accounts and federated identity trusts. Implement just-in-time access for cross-agency database queries. Eliminate standing privileges where possible. </td> </tr> <tr> <td> 🟡 </td> <td> CISO </td> <td> Commission assessment of AI coding assistant usage across state development teams. Establish policy for approved tools, configuration file governance, and supply chain security requirements for AI-assisted development. </td> </tr> </tbody> </table> <h3> Executive/IR Preparedness </h3> <ul> <li> CIO Decision Required: Approve emergency Conditional Access policy change to block device code authentication flow (Kali365 mitigation) </li> <li> CISO Decision Required: Direct DevOps teams to conduct emergency dependency audit for TrapDoor packages </li> <li> IR Readiness: Ensure incident response playbooks cover OAuth token compromise scenarios — traditional credential reset does NOT invalidate stolen OAuth tokens. Token revocation procedures must be documented and tested. </li> </ul> <h2> IOC Blocking Table </h2> The following indicators are confirmed from intelligence collection and should be added to blocking infrastructure: <table> <thead> <tr> <th> Type </th> <th> Value </th> <th> Context </th> </tr> </thead> <tbody> <tr> <td> Domain </td> <td> ddjidd564.github[.]io </td> <td> TrapDoor supply chain attack payload host </td> </tr> <tr> <td> File </td> <td> trap-core.js </td> <td> Shared malicious npm payload across TrapDoor packages </td> </tr> <tr> <td> File </td> <td> .cursorrules </td> <td> AI assistant poisoning configuration (check repos for unauthorized instances) </td> </tr> <tr> <td> File </td> <td> CLAUDE.md </td> <td> AI assistant poisoning configuration (check repos for unauthorized instances) </td> </tr> </tbody> </table> Additional IOCs for the campaigns discussed in this report — including indicators for Kali365 infrastructure, APT28 operations, and ransomware group C2 — are available through Anomali ThreatStream and partner feeds. <h2> Bottom Line </h2> The intelligence picture this week delivers a clear message: identity infrastructure is the battleground . Kali365 exploits device code flow. Lithuania's breach exploited inter-agency credential trust. TrapDoor exploits developer credential storage. Three different campaigns, three different actors, one common thread — whoever controls the tokens controls the kingdom. State government M365 GCC tenants with device code flow enabled are running with an open door that the FBI has now publicly confirmed attackers are walking through. The mitigation is architectural, not behavioral — no amount of security awareness training will stop a user from entering a device code when the phishing lure is AI-generated and contextually perfect. Block the flow. Audit the tokens. Segment the trust boundaries. The threat actors are not waiting. Anomali CTI Desk | 2026-05-25 | TLP:GREEN This report is derived from intelligence collected through 2026-05-25. Threat assessment levels reflect analyst judgment based on corroborated multi-source intelligence. Organizations should adapt recommendations to their specific environment and risk tolerance.

FEATURED RESOURCES

June 1, 2026

Anomali Cyber Watch

Iranian Cyber Operations Enter Critical Window as Kinetic Conflict Reaches Day 94

June 1, 2026

Anomali Cyber Watch

Public Sector

Software Supply Chain Attacks Hit Developer Tools as Russian APT28 Expands Domestic Infrastructure

May 29, 2026

Anomali Cyber Watch

Iran's Cyber Paradox: Degraded APTs, Empowered Proxies, and the Rise of Bootkit Wipers

Explore All